 (defn generate-s3-upload-policy
   [{:aws/keys [credentials-provider] region :aws-region bucket :aws-bucket :as config} {:keys [starts-with]}]
   (when credentials-provider
-    (let [[api-key api-secret] (credentials-provider)
+    (let [[api-key api-secret ?security-token] (credentials-provider)
           utc-now (aws/utc-now)
           day (.format utc-now aws/basic-date-format)
           date (.format utc-now aws/basic-date-time-format)

                       {"x-amz-algorithm" "AWS4-HMAC-SHA256"}
                       {"x-amz-credential" credential}
                       {"x-amz-date" date}]}
                     json/write-str
                     aws/str->bytes
                     Base64/encodeBase64String)]


(defn readable-s3-url
  [{:aws/keys [credentials-provider] region :aws-region :as config} expires-seconds path]
  (let [[api-key _ ?security-token] (credentials-provider)
        utc-now (aws/utc-now)
        query-str (str "X-Amz-Algorithm=AWS4-HMAC-SHA256"
                       "&X-Amz-Credential=" api-key "/" (.format utc-now aws/basic-date-format) "/" region "/s3/aws4_request"
